First, I'd note the time of the notification. Then, I would check for any audit entries around that time (could be a child object, so include link events too; this makes the next step easier if you get results here)

Next, I would check the workflows and triggered actions for the relevant object

Since a notification is being triggered, it should be relatively straightforward to identify the trigger - this is to isolate why it is happening in these particular instances.

You mention that they are seemingly random - have you checked for any 'patterns'?